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An unconditionally secure quantum cion tossing protocol 
for two remote participants via entangled swapping is pre- 
sented. The security of this protocol is guaranteed by the 
nonlocal property of quantum entanglement and the classical 
complexity. 

PACS number(s): 03.67.Dd, 03.65.Ud, 89.70.+C 



I. INTRODUCTION 

Quantum cryptography is a field which combines quan- 
tum theory with information theory. The goal of this field 
is to use the laws of physics to provide secure information 
exchange, in contrast to classical methods based on (un- 
proven) complexity assumption. Since the publication 
of BB84 protocol, quantum key distribution (QKD) [jl]]|] 
has developed into a well understood application of quan- 
tum mechanics to cryptography. In particular, quantum 
key distribution protocols became especially important 
due to technological advances which allow their imple- 
mentation in the laboratory ||. Besides QKD, quan- 
tum cryptography has many other applications, such as 
quantum bit commitment, quantum coin tossing (QCT), 
quantum secret sharing, quantum secure computation, 
oblivious transfer of quantum cryptography and quan- 
tum gambling Q], etc. However, Mayers and Lo and 
Chau H have shown that ideal quantum bit commitment 
is insecure. Their work also raised serious doubts on the 
possibility of obtaining any secure two-party protocol, 
such as oblivious transfer and coin tossing. 

Coin tossing is defined as a method of generating a 
random bit over a communication channel between two 
distant parties. The parties, traditionally named Alice 
and Bob, do not trust each other, or a third party. They 
create the random bit by exchanging quantum and clas- 
sical information. At the end of the protocol, the gen- 
erated bit is known to both of them. Coin tossing can 
be done in classical cryptography either through trusted 
intermediaries or by accepting some unproven computa- 
tional assumptions 0. However, it is interesting whether 
quantum mechanics can provide secure coin tossing pro- 
tocol without assistance of intermediaries. 



A coin tossing protocol is said to be ideal if the prob- 
ability that the result accepted by both parties without 
cheating is exact one, and both outcomes and 1 oc- 
cur with equal probability of 1/2. Lo and Chau proved 
that the secure ideal coin tossing protocol is impossi- 
ble and it does not matter whether the protocol is 
purely quantum, classical or quantum but with measure- 
ments. However, the unconditionally secure protocols 
of non-ideal QCT have been proposed |) 10 and it was 
shown that coin tossing is strictly weaker than bit com- 
mitment jy]. As denoted in ||, in the non-ideal case, it 
is requested that, for b = 0, 1, the probability that Alice 
gets bit b and passes the test is smaller than 1/2 what- 
ever she does, and similarly for Bob. If the bound 1/2 
perfectly against any of the two participants, the task 
realized is called an exact coin tossing. If the bound is 
actually 1/2 + £ where the bias £ vanishes when a secu- 
rity parameter defined by the protocol increases, the task 
realized is a (non-exact) coin tossing. It was found that 
exact coin tossing is impossible ^ . 

On the other hand, the nonlocal correlation of EPR 
|l2| state has been applied to do much work in quantum 
information field, such as quantum teleportation and en- 
tanglement swapping [fl3|| , quantum dense coding [p^[ , 
QKD Q and reducing the complexity of communication 
pHl] , etc. However, new applications of the EPR state in 
quantum information field are still to be discovered. 

In this paper, we present a quantum coin tossing pro- 
tocol via entanglement swappi ng |15| which method has 
been used in QKD by Cabello Jl|@. This paper is or- 
ganized as follows. In Section II, we give the framework 
of our coin tossing protocol, and security of this proto- 
col is analyzed in Section III. In Section IV, we consider 
the practical situation and discuss the robustness of this 
protocol. Section V concludes the paper. 



II. COIN TOSSING PROTOCOL 

At the beginning, Alice and Bob have a pairs of max- 
imally entangled particles respectively. Suppose the ini- 
tial state of the entangled particles is 



1 



l* + ><, = ^(l«>> + |ii» 



(1) 



*Electronic address: cfli@ustc.edu.cn 
^Electronic address: gcguo@ustc.edu.cn 



which is one of the four Bell states. The other three Bell 
states are 
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|*-> y =i(|00)-|ll))y, (2) 
=^(|01) + |lO))y, 

l*->« =^(|oi)-|io)) y . 

We denote the four Bell states |$ + ), I* - ), \^ + ) and 
|*-) by two classical bits as "00", "01", "10" and "11" 
respectively. Suppose Alice has particles 1 and 2 and 
Bob has particles 3 and 4. The four particles are in state 
|$ + ) 12 (g) |$ + ) 34 . In the next step, Alice sends particle 
2 to Bob and Bob sends particle 4 to Alice. Then Alice 
performs a Bell type measurement on particles 1 and 4 
and Bob performs a Bell type measurement on 2 and 3, 
respectively. According to the theory of entanglement 
swapping the measurement result will be a |$ + ) 1 4<8) 
a | < E >+ ) 2 3! where a is one of the operators of /, X, Y and 
Z. I, X, Y and Z are defined as 

'-(i!)- x -(!i)- y -(!"o 1 ).'-(ii 

(3) 

The two parties will get the same completely random 
result which is one of the four Bell states (respectively 
denoted by "00", "01", "10", "11"). If we use "0" to repre- 
sent "00" or "11" and "1" to represent "01" or "10", this 
process can be regarded as a simple coin tossing process. 

However, only steps mentioned above are not enough 
to prevent one party from cheating. For example, sup- 
pose that Alice wants the result to be "0" , she can apply 
operation / or Y on the particle 4 which is sent out by 
Bob, then send it back to Bob as particle 2. Otherwise, 
if she wants the result to be "1" , she can apply operation 
X or Z on particle 4 and send it back. 

In the following we give the modification to the naive 
protocol. Alice and Bob respectively have N pairs entan- 
gled particles in the initial. We denote Alice's particles by 
i from 1 to 2N, and Bob's particles by j from 1 to 2N. 
Alice's (2m — l)th and 2mth particles are entangled in 
state |$ + ), so are Bob's particles. First, Alice sends her 
particles which are numbered by 2m — 1 (m = 1, 2, ■ • • N) 
to Bob with a random sequence not known by Bob. Af- 
ter received all of particles sent by Alice, Bob sends his 
particles numbered by 2m — 1 (m — 1,2, ■• ■ N) to Al- 
ice in a sequence known by Alice. After received Bob's 
particles, Alice announces the sequence of practices she 
has sent to Bob. Then Alice (Bob) performs N times 
Bell type measurement on the N pairs of her (his) par- 
ticles, each pair including a particle of herself (himself) 
numbered by 2m and a particle sent by the other party 
which was numbered by 2m — 1. Both the two parties add 
their measurement results (e.g. |$ + ) , \*&~) are denoted 
by "0" and |$") , |*+) are denoted by "1"). If the sum 
is even, the tossing result is "0", otherwise the tossing 



result is "1". In other words, the tossing result is defined 
as the total parity bit of the N Bell type measurement 
results. At the end, the result can be announced to each 
other participant through public communication channel. 

However, only above steps are not sufficient to guaran- 
tee the security of this protocol, that is, can not against 
Bob's cheating. In fact, if Bob wants the result to be "0" , 
he can simply send all Alice's particles back and casually 
announce Alice a sequence of the particles he send out, 
without doing anything else. If he wants the result to be 
"1" , he can apply a unitary transformation (X or Z) on 
any one of particles sent by Alice before sending them 
back. To check whether Bob has cheated by this means, 
it requires that Bob announces all his measurement re- 
sults to Alice. Since that Alice sends particles in the first 
order, she can not change the probability distribution of 
Bob's measurement results and needs not to announce 
her measurement before she knows Bob's results. 

III. SECURITY ANALYSIS 

Now consider the security of this protocol. Assume 
that an honest participant should use the value "abort" 
only if he detects that the other participant has cheated 
or failed to collaborate. Using the value "abort" at other 
time is dishonest. It is shown that no secure coin toss- 
ing protocol would exist if a protocol could be declared 
insecure only because a dishonest participant can adopt 
this abort strategy 0. Therefore, we don't consider this 
case. 

Before analyzing the security, we give a lemma which 
will be used later. We define the parity of Bell measure- 
ment result |$+) ("00") and |*") ("11") be even ("0"), 
and the parity of |$~) ("01") and |*+) ("10") be odd 
("1"). 

Lemma. — Bell type measurement on any two parti- 
cles among N pairs of particles entangled in EPR state 
cannot change the total parity of the N pairs of particles. 

Proof. — We number all the N pairs of particles from 
1 to 2N, and the (2i — l)th particle is entangled with the 
2ith particles. It is obvious that if the measurement on 
the two particles numbered (2j — l)th and 2jth particles 
does not change the total parity (where 1 < i,j < N). 
Without loss of generality, assume that the measurement 
is on particle 2j — 1 and 2i (i ^ j). After the mea- 
surement, the four-particle (2j — 1, 2j, 2i — 1 and 2i) 
state will be changed from |$i) 2 j_i n ® I ^2)27—1 2j to 
o- l$i) 2 j-i,2i® a l $ 2)2 4 _i, 2j> wnere and I $2) are any 
EPR states. Obviously, the total parity of the two new 
pairs is the same of the two original pairs. Since other 
particles are not changed, the total parity of the N pairs 
does not change under Bell type measurement. And we 
can naturally obtain the below corollary. 

Corollary. - Entanglement swapping between any 
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two pairs among N pairs of EPR states cannot change 
the total parity of the TV EPR pairs. 

We consider Alice's strategy first. Since that she sends 
particles first, no matter what type of state and what 
sequence she adopts, she cannot change the probabilities 
of the two outputs of Bob. Suppose the state of the par- 
ticles Alice sends out is pi y z--,2N-i (we have considered 
the sequence in the subscript) and the state of Bob's par- 
ticles is 2 ji if Bob projects Alice's particles and 
his own particles numbered in even numbers onto Bell 
basis, each projection results will be independently and 
completely random. The total parity has equal proba- 
bility to be "0" or "1". Besides, Alice cannot check the 
credibility of Bob's results. So Alice needs not to cheat 
by sending fake particles. 

There is another question whether she can cheat after 
Bob sends his particles and the information of the se- 
quence of his particles. For example, she measures her 
particles and the particles sent by Bob in Bell basis ac- 
cording to the coin tossing rules. Suppose she wants the 
result to be "0" , if she gets the result "0" , she announces 
the true particles' sequence she sent out. Otherwise, 
she announces another sequence, and expects that Bob's 
measuring will bring the different result — "1". How- 
ever, from the lemma, we can deduce that this strategy 
could not change Bob's measurement result and in fact, 
there is no way for Alice to change the probabilities of 
Bob's two outputs after Alice sends out her particles. 

Bob has the following strategy. When he receives Al- 
ice's particles and should send back his own particles, he 
can sends back Alice's particles directly if he wants to get 
the result "0" or he can send them back after applying a 
X or Z type unitary transformation on any particle if he 
wants the result to be "1". It can be deduced from the 
lemma that this strategy will be effective. However, since 
he must announce the sequence of particles he sends out 
before knowing the sequence of particles sent by Alice, 
he can not definitely give the exact results of Alice's all 
Bell type measurements. What Bob can definitely give 
out is only the final result — the total parity of all the 
Bell type measurement results. The average probability 
that Bob's guess of Alice's measurement results will be 
pass Alice's test is 



which exponentially decreases with TV increasing. So the 
bias vanishes exponentially in this coin tossing protocol. 
The detail procedure to deduce the result of P in Eq. (4) 
is shown in the Appendix. 



IV. ROBUSTNESS OF THE PROTOCOL 

Up to this point, we assume that the initial state of 
a EPR pair is purely in |$ + ) and all operations are ex- 
act. But in practice, the decoherence of quantum states 
and errors of operations occur almost all the time. The 
measurement results of the two parties will not always 
be consistent since the errors were introduced. If the 
probability that the inconsistent results arise exceeds the 
probability in Eq. (4), the protocol becomes useless. 

Suppose the probability that a single measurement will 
get the correct result is T, it must satisfy the condition 

1 -T N < P. (5) 

From this equation, it can be concluded that this protocol 
is very sensitive to error. For example, if P < 0.0 1 (that 
is, N > II), it requires that T > 99.91% with N = 11. 

V. CONCLUSION 

In this QCT protocol, entanglement swapping is used 
to establish the coincidence of the two participants. The 
security is guaranteed mainly by the complexity of classi- 
cal information such as the random sequence Alice uses. 
In this protocol, when Alice knows the result, she cannot 
change the result. If Bob tries to cheat, the probability 
he passes the check is exponentially small, else he can- 
not change the probabilities of the two outputs. From 
the above analysis, it can be concluded that though this 
protocol is not an exact coin tossing protocol, the bias 
vanishes exponentially. 
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APPENDIX: Deduction of Eq. (4) 

Without loss of generality, we only consider the case 
that Bob wants the result to be "0" , and Bob sends Al- 
ice's particles back directly after he received the particles. 
Since Bob does not know the sequence of Alice's parti- 
cles he received, he can only guess a random sequence 
and send it to Alice. After Alice announces the sequence 
that she has sent out the particles, Bob compares this se- 
quence with the sequence he has announced to Alice and 
makes a set of Bell type measurement results for Alice's 
check. 

Suppose that after comparing the two sequence, Bob 
finds out that Alice's N pairs of entangled particles can 
be divided to m (1 < m < N) groups, with each group 
has some (say rik, 1 < k < M) complete pairs and (n^) 
Bell type measurements, and any group cannot be di- 
vided into some subgroups with above properties. 
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The number of the methods that divide N EPR pairs 

into m groups is ^ ^ J J . For a group has EPR 

pairs, the Bell type measurements have definite parity 
(it can be deduced from the lemma), so the number of all 
possible measurement results is 4™ fc_1 . Thus the number 
of all possible measurement results of the N EPR pairs 
is 4: N ~ m . Now we can get the average probability that 
Bob's guess could pass Alice's test 
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